Incident response

MonoDuty Webhooks

Create MonoDuty webhooks, configure notification channels, format alert payloads, and secure requests with HMAC signatures.

Webhooks Overview

MonoDuty's Webhooks product is designed to work with any tool or service that can make HTTP requests. This means you can integrate with Grafana, Prometheus, custom scripts, CI/CD pipelines, and literally anything else.

Universal Compatibility If your tool can send an HTTP POST request, it can send alerts through MonoDuty.

Creating Webhooks

You can create webhooks through the Dashboard UI or via the API.

Via Dashboard

Navigate to Dashboard → Webhooks
Click "Create Webhook"
Enter a name and description
Select notification channels
Configure optional settings (payload template, filters)
Click "Create"

Via API

curl -X POST https://api.monoduty.com/v1/webhooks \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Production Alerts",
    "channels": ["sms", "email"],
    "description": "Alerts from production servers"
  }'

Webhook Payload Format

MonoDuty accepts JSON payloads with the following fields:

Field	Type	Required	Description
`title`	string	Yes	Alert title/subject
`message`	string	No	Detailed alert message
`severity`	string	No	critical, warning, or info (default: info)
`source`	string	No	Source system (e.g., "grafana", "prometheus")
`tags`	object	No	Key-value metadata
`url`	string	No	Link to related dashboard/page

Example Payload

{
  "title": "High CPU Usage on web-server-01",
  "message": "CPU usage exceeded 90% for 5 minutes",
  "severity": "warning",
  "source": "prometheus",
  "tags": {
    "host": "web-server-01",
    "environment": "production"
  },
  "url": "https://grafana.example.com/d/abc123"
}

Flexible Parsing MonoDuty also accepts payloads from common tools (Grafana, Prometheus, etc.) in their native format. We automatically parse and extract the relevant information.

Webhook Security

Secure your webhooks with these best practices:

Webhook Secrets

Each webhook can have a secret key for signature verification:

# Include HMAC signature in header
curl -X POST https://api.monoduty.com/webhook/YOUR_WEBHOOK_ID \
  -H "Content-Type: application/json" \
  -H "X-MonoDuty-Signature: sha256=COMPUTED_SIGNATURE" \
  -d '{"title": "Alert"}'

IP Allowlisting

Restrict webhook access to specific IP addresses in your webhook settings.